do not use trusted forest name to construct domain admin principal

[martbab]

When trust-add is supplied AD domain admin name without realm component, the
code appends the uppercased AD forest root domain name to construct the full
principal. This can cause authentication error, however, when external trust
with non-root domain is requested.

We should instead use the supplied DNS domain name (if valid) as a realm
component.

https://fedorahosted.org/freeipa/ticket/6277

[abbra]

NACK. This is wrong.
In the case of external trust to a child domain we cannot run netr_DsRGetForestTrustInformation() against the child domain, regardless what credentials we have. Instead, we should run this request against the forest root domain using the credentials specified by the user.

[martbab]

I am under the impression that the problem you describe (https://fedorahosted.org/freeipa/ticket/6057) is orthogonal to the issue reported in this particular ticket. Yes we need to ask the forest root DCs for the forest topology information, but we need to get the right credentials in the first place.

If the user is establishing an external trust against e.g child domain but the code assumes that he wants to authenticate as the forest root domain admin instead of child domain admin it is an issue that can and should be handled separately.

[abbra]

Apologies. This is indeed a minor issue which is correctly fixed, so ACK for this one.
Note, though, this will not help with the actual query because regardless of what credentials were used, AD DC of a child domain behaves wrongly in Windows Server 2012R2 by not following MS-NRPC 3.5.4.7.5.

[MartinBasti]

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/f32e0e4e522e09390f4295dd79f52d7a48877d3a